Status

What is deployed, what was audited, and what the tests cover. If something here says none, it is none.

Contracts on Robinhood Chain

Not deployed. The contracts exist and are tested; no mainnet deployment has been made. The runbook is DEPLOY.md. Nothing on this site can move tokens until this section lists addresses.

No owner, no pause, no upgrade path: the pool's configuration is its immutable constructor arguments. 204 factory tokens are known to the app, read from the StockFactory on chain.

Trusted setup

Not run. Local testing uses a single-party development key whose verifier is refused by the deploy script on any public chain. The ceremony procedure is CEREMONY.md.

Audit

None yet. The circuit and contracts have been reviewed internally; one finding, an unconstrained leaf index that allowed multiple nullifiers per note, was found and fixed before any deployment. That review is not an audit.

Tests

Contract unit tests23Contract fuzz tests5 × 256 runsContract invariants4 × 64 runsFork tests against mainnet6, including registering all 204 tokensCircuit tests18, including the index-malleability regressionRelayer tests8End-to-endprotocol and browser, on every pushContinuous integrationGitHub Actions, every push

What the issuer can still do

Stock tokens carry issuer powers that Shell cannot remove: a global pause, a per-address block list on every transfer, an admin burn from any holder including the pool, and an upgradeable implementation. Read the threat model.